CmdID

CmdID / Files

rzpnk.sys

Razer Overlay Support file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entryhttps://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/

21 known samples

Show the 21 samples’ SHA-256 hashes

1.0.12.10201 · its entry

46d1dc89cc5fa327e7adf3e3d6d498657240772b85548c17d2e356aac193dd28

1.0.12.10201 · its entry

4c2d2122ef7a100e1651f2ec50528c0d1a2b8a71c075461f0dc58a1aca36bc61

1.0.12.10201 · its entry

d59cc3765a2a9fa510273dded5a9f9ac5190f1edf24a00ffd6a1bbd1cb34c757

1.0.12.10201 · its entry

dafa4459d88a8ab738b003b70953e0780f6b8f09344ce3cd631af70c78310b53

1.0.12.10177 · its entry

0b547368c03e0a584ae3c5e62af3728426c68b316a15f3290316844d193ad182

1.0.12.10177 · its entry

9eba5d1545fdbf37cf053ac3f3ba45bcb651b8abb7805cbfdfb5f91ea294fb95

1.0.12.10177 · its entry

9fa120bda98633e30480d8475c9ac6637470c4ca7c63763560bf869138091b01

1.0.12.10177 · its entry

f15962354d37089884abba417f58e9dbd521569b4f69037a24a37cfc2a490672

1.0.12.10155 · its entry

2665d3127ddd9411af38a255787a4e2483d720aa021be8d6418e071da52ed266

1.0.12.10155 · its entry

567809308cfb72d59b89364a6475f34a912d03889aa50866803ac3d0bf2c3270

1.0.12.10155 · its entry

93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63

1.0.12.10155 · its entry

d7b743c3f98662c955c616e0d1bb0800c9602e5b6f2385336a72623037bfd6dd

1.0.12.9986 · its entry

0507d893e3fd2917c81c1dc13ccb22ae5402ab6ca9fb8d89485010838050d08d

1.0.12.9986 · its entry

ad8fd8300ed375e22463cea8767f68857d9a3b0ff8585fbeb60acef89bf4a7d7

1.0.12.7465 · its entry

8ed0c00920ce76e832701d45117ed00b12e20588cb6fe8039fbccdfef9841047

1.0.12.7465 · its entry

9724488ca2ba4c787640c49131f4d1daae5bd47d6b2e7e5f9e8918b1d6f655be

1.0.12.7465 · its entry

a66d2fb7ef7350ea74d4290c57fb62bc59c6ea93f759d4ca93c3febca7aeb512

1.0.12.7465 · its entry

e77786b21dbe73e9619ac9aac5e7e92989333d559aa22b4b65c97f0a42ff2e21

1.0.12.6087 · its entry

9e3430d5e0e93bc4a5dccc985053912065e65722bfc2eaf431bc1da91410434c

1.0.12.3137 · its entry

0c925468c3376458d0e1ec65e097bd1a81a03901035c0195e8f6ef904ef3f901

1.0.12.3137 · its entry

16e2b071991b470a76dff4b6312d3c7e2133ad9ac4b6a62dda4e32281952fb23

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real rzpnk.sys?

file version info and known copies
ProductRzpnk, Razer, Inc.
DescriptionRazer Overlay Support

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names rzpnk.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.